Pukyong National University (PKNU) in Busan has confirmed that an outside attacker accessed personal data belonging to 5,108 people: 5,106 students and two staff members. The intrusion happened in Campus e-Moa, the tuition collection system that Suhyup Bank runs for the university, not in PKNU's own network. The university posted an apology and disclosure notice on its website on October 23, 2026. The Seoul Economic Daily reported the breach on October 25 and gave the same figures. PKNU learned of the incident only when someone used the stolen data to demand money. No threat actor has been named and no one has claimed the attack.
What Happened
PKNU's notice gives this timeline:
- October 17, 12:57 to October 18, 09:27: an external attacker exploited a security vulnerability in Suhyup Bank's Campus e-Moa system, created an unauthorized administrator account and used it to view personal data.
- October 20, around 21:40: PKNU became aware of the breach after someone used the leaked data to demand money. The notice does not say who received the demand or how it was delivered.
- October 23: PKNU's General Affairs Division published the disclosure and apology.
PKNU says it is working with Suhyup Bank and the relevant authorities to confirm how the attack worked and how far it reached. It has formed an incident response team, held an emergency meeting, reported the breach to the Ministry of Education and the Personal Information Protection Commission (PIPC), and asked the police to investigate. Affected people are being notified individually, and Suhyup Bank is running a dedicated call center (1577-1628, weekdays 09:00 to 18:00).
The attacker was in the system for roughly 20 hours. The university did not find out until about two and a half days after the session ended, and only because the attacker made contact. Under the 72-hour notification rules described by SEUM Law's Korean Data Law Notes, PKNU's notice on October 23 appears to fall within the window after it became aware on October 20. The notice does not give a posting time, so this cannot be confirmed precisely.
What Was Taken
The university's own notice and the Seoul Economic Daily give the same figure of 5,108 people, so there is no discrepancy in the record count. The Seoul Economic Daily's headline line rounds this to "about 5,000."
- Students (5,106): name, student ID or applicant number, department or major, tuition amount paid, and virtual account number.
- Tuition staff (2): name, department, job title, extension number, mobile phone number and email address.
PKNU says no further data was exposed, and specifically no resident registration numbers. The data is not highly sensitive, but it is useful for fraud. A message that quotes a student's real name, ID, major, exact tuition amount and virtual account number is a convincing setup for "unpaid tuition," "refund," or "scholarship payment" scams. The two staff members whose mobile numbers and emails leaked are the people a fake bank or university message would plausibly come from. PKNU's notice warns about this kind of follow-on voice phishing and smishing.
Why It Matters
Third-party exposure in education is the main story. PKNU's own systems were not breached. A bank-operated collection platform was. Campus e-Moa serves universities as a product, so the same question applies to every other institution that uses it. Nothing published so far says whether other universities on the platform were affected. Suhyup Bank has not issued its own statement in the sources reviewed.
It fits a pattern of breaches at Korean universities and their vendors. Kookmin Ilbo, citing Ministry of Education data obtained by Rep. Baek Seung-ah, reports 140 hacking incidents at Korean universities from 2021 to 2026 and at least 2,976,034 personal data items leaked. That figure covers 281,917 items in 2026 alone, including Sogang University's 185,701-item web hacking incident in August. The outlet notes that the total includes leaks through outsourced vendors, and that in 2026, vendor incidents doubled the number of university-related leaks from 5 to 10. Korea JoongAng Daily separately reports that Seoul National University had 28 incidents over the same period and detects more than 500 intrusion attempts a year.
It is part of a wider national wave. The Korea Data Economy Newspaper reports breaches in September and October at seven financial firms, including Shinhan, KB Kookmin, Hana and BNK Busan Bank. Attackers reached those firms through peripheral systems such as loan-broker lookup services and staff mobile tools, not core banking. The same outlet reports that learning-platform vendor MalgeunSoft reported about 2.37 million records to the PIPC, affecting more than 20 client organizations. The Kyunghyang Shinmun gives a larger count: 16 affected financial institutions as of October 14. It also reports a breach of about 10,000 records at Yonsei University's portal on October 22. The two financial-sector figures (7 versus 16) appear to reflect different dates and scope and should not be read as directly comparable. The Korea Data Economy Newspaper says officials suspect AI-assisted intrusion tooling in some of these incidents and that the Prime Minister has ordered a government-wide review. None of the sources link the PKNU breach to any of these campaigns.
Attribution is unknown. Dark Reading's recent reporting on a suspected APT37 campaign against South Korean media and automotive firms shows that state actors are active in Korea. That campaign was espionage-focused and used load-balancer implants. PKNU's breach was a quick data grab followed by a money demand, which looks financially motivated. No source connects the two, and readers should not infer a link.
The Attack Technique
From PKNU's account:
- Initial access: the attacker exploited an unspecified vulnerability in the Campus e-Moa web system.
- Privilege escalation and persistence: the attacker created an unauthorized administrator account. PKNU's fixes, which include blocking new member sign-ups and strengthening registration and authentication, suggest the account-creation or sign-up flow was the weak point. The university has not stated this directly.
- Collection: the attacker used the admin account to query and view personal records. PKNU's planned limits on bulk personal data queries suggest the platform allowed large-scale lookups without throttling or alerts.
- Monetization: the attacker made an extortion demand using the stolen data about 60 hours after the session ended.
PKNU has blocked the attacking IP addresses, tightened external access controls, disabled the unauthorized accounts and preserved evidence. No CVE, vendor advisory or indicators of compromise have been published.
What Organizations Should Do
- Inventory every third-party system that holds your users' data, including bank-run payment, tuition and LMS platforms. Ask vendors for evidence of recent security testing and breach notification commitments in the contract.
- Alert on any new privileged account. Creating an admin account on a payment or records platform outside change control should page someone immediately, not surface days later.
- Lock down self-service registration and role assignment. Make sure no sign-up path can grant elevated roles, and require MFA for every administrative account.
- Rate-limit and monitor bulk queries of personal data. A sudden run of hundreds or thousands of record views from one account is the clearest sign of exfiltration.
- Prepare for follow-on phishing. Warn affected people about scams that quote tuition or refund details, publish official contact channels, and brief help desks and finance staff, who will be impersonated.
- Rehearse Korea's notification timelines. Under the regime summarized by Korean Data Law Notes, separate 72-hour deadlines apply to notifying data subjects and reporting to the PIPC or KISA. Since September 11, 2026, a further obligation starts on mere suspicion of a leak.
Sources: Data of 5,108 Leaked at Pukyong National University - Seoul Economi... | Cyber Op Targets South Korean Media & Automotive Sectors | 공지사항 | 단독 6년간 대학서 유출된 개인정보만 최소 297만개 - 국민일보 | Seoul National University hit by 28 cyberattacks, 1,100 personal da... | 데이터 사건파일 AI 해킹에 뚫린 금융권·교육 플랫폼, 정부 대응과 ISMS-P 의무화 쟁점 < 데이터 보안·프라이버... | “Where is it today, again?”… From financial firms·coffee shops·even... | Korea breach notification: the 72-hour clock, who to tell, and what...